By Bob Paterson When a customer clicks “reject” on a website’s cookie notice, the reasonable expectation is that optional tracking will stop. Visitors to Arby’s and several other restaurant sites say the opposite happened: tracking software allegedly continued collecting and sharing information despite their privacy choices. A proposed federal class action challenges the accuracy of those opt-out promises. In June 2026, the court let several claims move forward, while dismissing or narrowing others. The ruling concerns what the plaintiffs pleaded—not a finding that the restaurant chains committed fraud.
Who Is Suing Arby’s?
The relevant proceeding is *De Ayora v. Inspire Brands, Inc.*, No. 3:25-cv-03645, in the U.S. District Court for the Northern District of California. Plaintiffs include Benjamin Paul de Ayora, Christine Wiley, Mikhail Gershzon and George Nino. Defendants include Inspire Brands and entities associated with Arby’s, Jimmy John’s, Sonic and Dunkin’, with allegations also discussing the Baskin-Robbins site.
The case initially involved a petition concerning an arbitration award. After a July 2025 order, the federal court permitted a civil complaint to proceed. The plaintiffs later amended their allegations, and their privacy claims became the focus of dismissal motions.
What Did Website Visitors Allege?
The lawsuit says certain restaurant websites displayed cookie-consent banners offering users a choice to decline nonessential tracking. Plaintiffs allege that advertising and analytics technologies nevertheless continued recording or transmitting information, including online activity and identifiers, after some users refused consent.
The complaint links the alleged disclosures to business uses such as ad measurement, cross-site marketing and consumer profiling. But the fact that a website uses analytics is not by itself unlawful. The legal question is what it promised visitors, whether tracking continued contrary to that representation, what information was collected and whether the plaintiffs can establish an actionable injury.
What Was the June 2026 Ruling?
U.S. Magistrate Judge Alex G. Tse issued a 14-page order on June 8, 2026, partly granting and partly denying a motion to dismiss the operative amended complaint. The court found that the plaintiffs had sufficiently pleaded several theories, including fraud, unjust enrichment and invasion of privacy, to survive at this early stage.
Other theories had problems. The court dismissed portions of the California Invasion of Privacy Act (CIPA) claims, including George Nino’s claims against Arby’s without prejudice, and dismissed the federal wiretapping claim without prejudice. Some claims concerning other restaurant brands were dismissed with prejudice. The court permitted a further amendment by July 10, 2026.
That mixed outcome is essential: it would be inaccurate either to say Arby’s won the entire case or that a judge found the alleged tracking unlawful.
How Can the Restaurant Companies Defend the Claims?
The defendants may contest what a visitor actually selected, which technologies were enabled, whether information amounts to protected communications and whether legal exceptions or consent apply. They may also challenge whether the named plaintiffs suffered the type of harm required for standing and whether their experiences can support a nationwide class.
The court’s June ruling addressed the adequacy of particular allegations. Proof of tracking behavior and of any relationship between the opt-out messages and consumer decisions would require later evidence, such as software testing, records and expert analysis.
Arby’s Lawsuit Status in October 2026
The case is a proposed class action, not an approved settlement. The verified June 2026 order allowed several claims to proceed after trimming others, but available records reviewed through October 15 do not establish class certification, a merits verdict or a consumer payment program. The procedural history also differs from an Arby’s food-safety complaint or a retail payment-card breach, which should not be confused with these online privacy allegations.
Frequently Asked Questions
Q. Did the court find that Arby’s sold customers’ personal information?
No. The June ruling dealt with whether the complaint adequately alleged wrongful tracking and disclosure. It was not a trial determination of what data Arby’s collected or sold.
Q. Does using the Arby’s app automatically make someone a class member?
No. The case concerns specified alleged website practices, and no court-certified class has been verified. App usage alone does not determine eligibility.
Q. Can visitors file a settlement claim now?
No court-approved claims process or payout was identified for this proceeding as of October 15, 2026.
Q. Why were some claims dismissed while others survived?
Different privacy statutes require different elements, and the plaintiffs’ allegations varied by person and restaurant website. The court evaluated those distinctions rather than treating every brand and legal claim identically.